Computing

South Korea Probes AI-Linked Bank Breaches and Other Cyber Threats

A weekly cybersecurity review highlights emerging threats, including suspected artificial intelligence involvement in South Korean banking breaches, a novel poem-guided botnet, and high-profile legal updates.

Radwan AbdulhadiEditor and technology writer

Published: October 9, 2026 · Updated: October 9, 2026 · 4 min read

South Korea Probes AI-Linked Bank Breaches and Other Cyber Threats — Image: SecurityWeek

AI Suspected in South Korean Banking Attacks

South Korean President Lee Jae Myung stated that there are indications artificial intelligence played a role in recent hacking incidents targeting the nation's financial institutions, which resulted in a breach of personal customer data as detailed in reports on hacking incidents.

Police have initiated a comprehensive investigation into the security breaches. Authorities have not yet disclosed specific details regarding the AI tools utilized or the full scope of the compromise. CrowdStrike recently reported identifying Claude Code session histories, ARTEX configuration files, and Claude memory files while examining the underlying attack infrastructure, leading the security firm to assess with moderate confidence that a Chinese-speaking financially motivated threat actor is likely responsible.

PoeLLM Botnet Leverages GitHub Poetry for Command and Control

Black Lotus Labs has released details regarding PoeLLM, an active malware strain targeting exposed artificial intelligence and open-source services such as LiteLLM, Ollama, Gotenberg, and Gitea. The malware aims to mine cryptocurrency and expand an ongoing botnet.

Once a machine is infected, the malware extracts four distinct keywords from a poem hosted on GitHub, converting those terms into the IP address of its active command-and-control server. This mechanism allows the operator to dynamically shift servers by altering the poem's text. Security researchers indicate the operator has updated the GitHub poem eleven times.

Dark Web Marketplace Co-Founder Sentenced to 40 Years

In major law enforcement updates, Raheim Hamilton, a 30-year-old from Virginia, received a 40-year prison sentence alongside a $5 million fine. Hamilton pleaded guilty to a drug conspiracy charge relating to Empire Market, a dark web marketplace he co-founded and operated alongside Thomas Pavey between 2018 and 2020.

During its operational lifetime, the platform processed over four million transactions valued exceeding $430 million, primarily involving illicit drugs. The marketplace also facilitated the sale of stolen credentials, personal information, counterfeit currency, and specialized hacking tools. Pavey, who entered a guilty plea previously, awaits sentencing later this month.

Uranium Finance Hacker Convicted by Jury

A federal jury convicted 36-year-old Jonathan Spalletta of Maryland on charges of computer fraud and money laundering stemming from two separate 2021 attacks against the decentralized cryptocurrency exchange Uranium Finance.

Court documents and investigative findings detailed by authorities indicate that the hacker exploited smart contract vulnerabilities to steal approximately $1.4 million in the initial incident and $53.3 million in the second attack, which ultimately forced the exchange to shut down permanently. Spalletta laundered the stolen assets through multiple cryptocurrency transactions, including Tornado Cash, before utilizing the funds to purchase rare collectibles and artifacts. He faces up to 10 years in prison for fraud and an additional 20 years for money laundering.

Nvidia GPU Monitoring Flaw and Additional Vulnerabilities

Researchers recently disclosed a high-severity vulnerability tracked as CVE-2026-47483 within Nvidia’s DCGM Exporter GPU monitoring utility. Unauthenticated malicious actors can flood profiling endpoints with requests, causing resource exhaustion and service crashes that potentially degrade AI workloads running on the affected host. Security scans conducted between March and May identified roughly 2,100 hosts exposing the monitoring tool directly to the internet without authentication, resulting in telemetry leaks from more than 12,000 graphics processing units. Nvidia has issued an update addressing the security flaw.

Additional supply chain and credential incidents continue to impact organizations across the globe. Domino’s recently initiated password resets for a small subset of customer accounts following credential stuffing attacks executed with email and password combinations acquired from unrelated third-party data breaches. Concurrently, GitGuardian revealed that the GhostAction supply chain campaign expanded its secret-stealing GitHub Actions workflow to hundreds of additional public repositories, targeting sensitive keys and database credentials.